     false
     (catch map? actual-map#
       (= actual-map# ~expected-map))))
+
+(defn contains-ext?
+  "Does the provided extension list contain an extensions with the given OID."
+  [ext-list oid]
+  (> (count (filter #(= oid (:oid %)) ext-list)) 0))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;; Tests

        (is (= exts exts-expected))))

    (testing "only puppet extensions are extracted from CSR and DNS alt names is ignored."
      (let [csr-exts [(utils/subject-dns-alt-names ["onefish"] false)
                      (utils/puppet-node-uid "AAAA-BBBB-CCCC-DDDD" false)]
            csr      (utils/generate-certificate-request
                       subject-keys subject-dn csr-exts)
            exts (create-agent-extensions csr issuer-pub)
            exts-expected [{:oid "2.16.840.1.113730.1.13"
                            :critical false
                            :value "Puppet JVM Internal Certificate"}
                           {:oid "2.5.29.35"
                            :critical false
                            :value issuer-pub}
                           {:oid "2.5.29.19"
                            :critical true
                            :value {:is-ca false
                                    :path-len-constraint nil}}
                           {:oid "2.5.29.37"
                            :critical true
                            :value [ssl-server-cert ssl-client-cert]}
                           {:oid "2.5.29.15"
                            :critical true
                            :value #{:digital-signature :key-encipherment}}
                           {:oid "2.5.29.14"
                            :critical false
                            :value subject-pub}
                           {:critical false
                            :oid      "1.3.6.1.4.1.34380.1.1.1"
                            :value    "AAAA-BBBB-CCCC-DDDD"}]]
        (is (= exts exts-expected))))))

        issuer-pub   (utils/get-public-key issuer-keys)
        subject-keys (utils/generate-key-pair 512)
        subject-pub  (utils/get-public-key subject-keys)
        subject      "subject"
        subject-dn   (utils/cn subject)]
    (testing "basic extensions are created"
      (let [csr  (utils/generate-certificate-request subject-keys subject-dn)
            exts (create-agent-extensions csr issuer-pub)
